Alertas de Seguridad de la Información

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13526] A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknow…

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_class.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13519] A vulnerability was found in Tenda JD12L 16.03.53.23. This impacts the function fromNatStaticSetting…

A vulnerability was found in Tenda JD12L 16.03.53.23. This impacts the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13521] A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php. Affect…

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php. Affected by this vulnerability is an unknown functionality of the file /preview5.php. Such manipulation of the argument course_year_section leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13517] A flaw has been found in Tenda JD12L 16.03.53.23. The impacted element is the function formWifiBasic…

A flaw has been found in Tenda JD12L 16.03.53.23. The impacted element is the function formWifiBasicSet of the file /goform/WifiBasicSet. Executing a manipulation of the argument security_5g can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13518] A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat …

A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13515] A security vulnerability has been detected in Tenda JD12L 16.03.53.23. Impacted is the function form…

A security vulnerability has been detected in Tenda JD12L 16.03.53.23. Impacted is the function formSetPPTPServer of the file /goform/SetPptpServerCfg. Such manipulation of the argument startIp leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13516] A vulnerability was detected in Tenda JD12L 16.03.53.23. The affected element is the function fromSe…

A vulnerability was detected in Tenda JD12L 16.03.53.23. The affected element is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet. Performing a manipulation of the argument shareSpeed results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13500] A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the …

A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the file tool/src/org/antlr/v4/codegen/model/OutputFile.java of the component Grammar Action Block Handler. Executing a manipulation can lead to code injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13498] A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an unk…

A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an unknown function of the file /forgotpassword.php of the component POST Parameter Handler. Such manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why informati…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13488] A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/7.php. A…

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/7.php. Affected by this vulnerability is an unknown functionality of the file /preview7.php. The manipulation of the argument course_year_section results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13487] A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is …

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive.php. The manipulation of the argument sy leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13486] A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/6.php. This i…

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/6.php. This impacts an unknown function of the file /preview6.php. Executing a manipulation of the argument course_year_section can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13485] A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an u…

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /preview.php. Performing a manipulation of the argument course_year_section results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

Z Alto vulnerabilidad

28/06/2026

[CVE-2026-10646] Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a po…

Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo_state ai_state) as the user_data of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set slightly longer than the resolver's own per-query timeout. When that semaphore wait nonetheless ti…

nvdaltovulnerabilidad CVSS 7.4 NVD

L Alto vulnerabilidad

28/06/2026

[CVE-2026-58050] libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsyste…

libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-58056] RustDesk gates incoming control messages on per-capability flags rather than on the session's author…

RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-58049] FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at t…

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled ou…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-8095] The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File …

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during u…

nvdaltovulnerabilidad CVSS 8.1 NVD

Z Alto vulnerabilidad

28/06/2026

[CVE-2026-10643] Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()…

Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payload length (msg->msg_controllen < pktinfo_len) before writing a full control message consisting of an aligned cmsg header plus the payload. Because the check omitted the cmsg header size, a control buffer whose length fa…

nvdaltovulnerabilidad CVSS 8.7 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49416] The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large valu…

The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation. An unprivileged local user with access to a vt(4) device can trigger an out-of-bounds write in the kern…

nvdaltovulnerabilidad CVSS 7.8 NVD